From: dirk <dirk@git.imagemagick.org>
Date: Mon, 20 Jun 2016 22:06:17 +0000 (+0200)
Subject: Added extra guards to prevent out of bound access.
X-Git-Tag: 7.0.2-1~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5675bb2439af1c441e1c9b763339ca2094d4b298;p=imagemagick

Added extra guards to prevent out of bound access.
---

diff --git a/MagickCore/accelerate.c b/MagickCore/accelerate.c
index 3a341c44e..fb6ddee32 100644
--- a/MagickCore/accelerate.c
+++ b/MagickCore/accelerate.c
@@ -429,13 +429,15 @@ static Image *ComputeAddNoiseImage(const Image *image,MagickCLEnv clEnv,
   queue=AcquireOpenCLCommandQueue(device);
   if (queue == (cl_command_queue) NULL)
     goto cleanup;
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -620,13 +622,15 @@ static Image *ComputeBlurImage(const Image* image,MagickCLEnv clEnv,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -4378,13 +4382,15 @@ static Image *ComputeResizeImage(const Image* image,MagickCLEnv clEnv,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,resizedColumns,resizedRows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -4595,13 +4601,15 @@ static Image* ComputeRotationalBlurImage(const Image *image,MagickCLEnv clEnv,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -4793,13 +4801,15 @@ static Image *ComputeUnsharpMaskImage(const Image *image,MagickCLEnv clEnv,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -4965,13 +4975,15 @@ static Image *ComputeUnsharpMaskImageSingle(const Image *image,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;
@@ -5117,13 +5129,15 @@ static Image *ComputeWaveletDenoiseImage(const Image *image,MagickCLEnv clEnv,
 
   device=RequestOpenCLDevice(clEnv);
   queue=AcquireOpenCLCommandQueue(device);
-  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
-  if (imageBuffer == (cl_mem) NULL)
-    goto cleanup;
   filteredImage=CloneImage(image,image->columns,image->rows,MagickTrue,
     exception);
   if (filteredImage == (Image *) NULL)
     goto cleanup;
+  if (filteredImage->number_channels != image->number_channels)
+    goto cleanup;
+  imageBuffer=GetAuthenticOpenCLBuffer(image,device,exception);
+  if (imageBuffer == (cl_mem) NULL)
+    goto cleanup;
   filteredImageBuffer=GetAuthenticOpenCLBuffer(filteredImage,device,exception);
   if (filteredImageBuffer == (cl_mem) NULL)
     goto cleanup;